According to the versions of the libyaml package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - Heap-based buffer overflow in the     yaml_parser_scan_uri_escapes function in LibYAML before     0.1.6 allows context-dependent attackers to execute     arbitrary code via a long sequence of percent-encoded     characters in a URI in a YAML file.(CVE-2014-2525)

  - The yaml_parser_scan_tag_uri function in scanner.c in     LibYAML before 0.1.5 performs an incorrect cast, which     allows remote attackers to cause a denial of service     (application crash) and possibly execute arbitrary code     via crafted tags in a YAML document, which triggers a     heap-based buffer overflow.(CVE-2013-6393)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated perl-YAML-LibYAML packages fix security vulnerabilities :

Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially crafted tag that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2013-6393).

Ivan Fratric of the Google Security Team discovered a heap-based buffer overflow vulnerability in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a specially crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2014-2525).

The perl-YAML-LibYAML package is being updated as it contains an embedded copy of LibYAML.

The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.

libyaml was updated to fix a regression introduced by the previous security patch for CVE-2013-6393.

The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

This update addressed two security issues.

CVE-2013-6393: The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.

CVE-2014-2525: The library is affected by a heap-based buffer overflow which can lead to arbitrary code execution. The vulnerability is caused by lack of proper expansion for the string passed to the yaml_parser_scan_uri_escapes() function. A specially crafted YAML file, with a long sequence of percent-encoded characters in a URL, can be used to trigger the overflow.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

perl-YAML-LibYAML was updated to fix three security issues.

These security issues were fixed :

  - CVE-2013-6393: The yaml_parser_scan_tag_uri function in     scanner.c in LibYAML before 0.1.5 performed an incorrect     cast, which allowed remote attackers to cause a denial     of service (application crash) and possibly execute     arbitrary code via crafted tags in a YAML document,     which triggered a heap-based buffer overflow     (bnc#860617, bnc#911782).

  - CVE-2014-9130: scanner.c in LibYAML 0.1.5 and 0.1.6, as     used in the YAML-LibYAML (aka YAML-XS) module for Perl,     allowed context-dependent attackers to cause a denial of     service (assertion failure and crash) via vectors     involving line-wrapping (bnc#907809, bnc#911782).

  - CVE-2014-2525: Heap-based buffer overflow in the     yaml_parser_scan_uri_escapes function in LibYAML before     0.1.6 allowed context-dependent attackers to execute     arbitrary code via a long sequence of percent-encoded     characters in a URI in a YAML file (bnc#868944,     bnc#911782).

This update was imported from the SUSE:SLE-12:Update update project.

Updated yaml packages fix security vulnerabilities :

Florian Weimer of the Red Hat Product Security Team discovered a heap-based buffer overflow flaw in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a YAML document with a specially crafted tag that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2013-6393).

Ivan Fratric of the Google Security Team discovered a heap-based buffer overflow vulnerability in LibYAML, a fast YAML 1.1 parser and emitter library. A remote attacker could provide a specially crafted YAML document that, when parsed by an application using libyaml, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2014-2525).

An assertion failure was found in the way the libyaml library parsed wrapped strings. An attacker able to load specially crafted YAML input into an application using libyaml could cause the application to crash (CVE-2014-9130).

ID	名稱	產品	系列	已發布	已更新	嚴重性
124948	EulerOS Virtualization 3.0.1.0 : libyaml (EulerOS-SA-2019-1445)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/23	medium
73445	Mandriva Linux Security Advisory : perl-YAML-LibYAML (MDVSA-2014:069)	Nessus	Mandriva Local Security Checks	2014/4/10	2021/1/6	medium
73652	Amazon Linux AMI : perl-YAML-LibYAML (ALAS-2014-324)	Nessus	Amazon Linux Local Security Checks	2014/4/23	2018/4/18	medium
75296	openSUSE Security Update : libyaml (openSUSE-SU-2014:0381-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
72747	Amazon Linux AMI : libyaml (ALAS-2014-291)	Nessus	Amazon Linux Local Security Checks	2014/3/2	2018/4/18	medium
73364	Fedora 19 : perl-YAML-LibYAML-0.41-4.fc19 (2014-4517)	Nessus	Fedora Local Security Checks	2014/4/7	2021/1/11	medium
90563	openSUSE Security Update : perl-YAML-LibYAML (openSUSE-2016-473)	Nessus	SuSE Local Security Checks	2016/4/18	2021/1/19	medium
81943	Mandriva Linux Security Advisory : yaml (MDVSA-2015:060)	Nessus	Mandriva Local Security Checks	2015/3/19	2021/1/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium